5 ms·

Hey! Post author here. I appreciate the insight from someone who's worked on this kind of thing formally, thanks. > Most likely what’s happening is that the c

Hey! Post author here. I appreciate the insight from someone who's worked on this kind of thing formally, thanks. > Most likely what’s happening is that the creep torque is applying a constant small torque and the wheel sensors are reading 0 continuously, so it continues to apply a constant small torque. This was also my hypothesis at the time of the post. Turned out it's less constrained than this, a fully operational car with the drive wheels off the ground will also run away to high rpm (even in Neutral): https://www.projectgus.com/2024/04/unremarkable/#on-car-testing https://www.projectgus.com/2024/04/unremarkable/#on-car-test... There's still minimal torque, as you say, so a small press on the car's brake pedal is all it takes to stop. However I think if a driveshaft broke on a real car then it'd be spinning fast for a minute or two... It kind of makes sense that the control loop is tuned for a heavy car with a fixed drive ratio, though. I am still hopeful there will be a way to stop this behaviour via a control signal (rather than pulling the safety interlock and slamming the contactors open). Have left the problem aside until I have a mechanical brake to use for testing! If that doesn't work out then it's still usable I think, provided any EV conversion is single speed fixed gear just like the Kona. If you have any other insights on this then I'd be very interested to hear them, though.

aetherspawn 2y ago
It won’t happen on a real car because the speed probably comes from the ABS wheel speed sensors, and in that case they would read the correct speed of the wheels (unless the motor shaft is proper broken). If the ABS is properly plugged in it will detect a fault with the sensors (which probably causes the creep to stop) however it won’t detect a mechanical fault with the encoder wheel (such as sensor not bolted to wheel) — such a fault is indistinguishable from the wheel not spinning, thus zero speed. I think you were emulating the ABS module right? In that case, the spinning out of control is actually probably your fault. If you had not emulated this, the system would realise there is an ABS fault (from the messages not being present) and not use the ABS reported speed. It might even fall back to motor speed automatically. Re: shaft scenario, if the motor shaft is broken the safety risk is pretty minimal because the torque wont actually cause the car to move. I guess this is what they arrived to in the FMEA.
- aetherspawn 2y ago
  Funnily enough I noticed recently that Japanese and Korean engineers usually argue against using checksums and random magic rolling bytes on these messages (“it will never happen”), in contrast Euro engineers use them everywhere. In this case the Euro method although more complex would have let the system know you are spoofing the ABS and no such motion would have happened.
  - jeffreygoesto 2y ago
    Well. Reading out failure memory from ECUs couple of years old showed us that all chechsums failed several times over that time...
  - Bluecobra 2y ago
    It makes we wonder if they have to do it that way, after what happened with VW lying about their diesel emissions.
  - tanjtanjtanj 2y ago
    My European car (2013 Volvo) had no checksum or even identifier for the firmware as I found out when my car would just randomly cut all power at speed. I brought it back to the dealership and they found it had a completely different car’s update (2017 different model) installed!
- Dylan16807 2y ago
  > I think you were emulating the ABS module right? In that case, the spinning out of control is actually probably your fault. If you had not emulated this, the system would realise there is an ABS fault (from the messages not being present) and not use the ABS reported speed. It might even fall back to motor speed automatically. If the ABS unit getting stuck causes that kind of acceleration then I'm going to point most of the fault at the control logic.
  - aetherspawn 2y ago
    Not really.. it will only be applying 5Nm or so which is such a small amount of torque that you could likely stop the wheel with your hand (equivalent to holding up 500g object with 1m ruler) He is spoofing an ABS message from a working vehicle that says “no faults present” on a vehicle that is clearly full of faults.
rightbyte 2y ago
Interesting. Sounds like really bad software. There should be some sort inertia estimation turning off the motor if the inertia don't include the wheels or whatever. There should also be some check that output axis speed (abs sensors) and motor speeds match. The behaviour sounds kinda dangerous and not up to ECU standards.
- aetherspawn 2y ago
  We don’t implement stuff like this because it would go off when you’re going down a slight incline for example, and the more bandaids you slap on it to get it to work, the more complex testing the failure scenario would be.

aetherspawn 2y ago

It won’t happen on a real car because the speed probably comes from the ABS wheel speed sensors, and in that case they would read the correct speed of the wheels (unless the motor shaft is proper broken). If the ABS is properly plugged in it will detect a fault with the sensors (which probably causes the creep to stop) however it won’t detect a mechanical fault with the encoder wheel (such as sensor not bolted to wheel) — such a fault is indistinguishable from the wheel not spinning, thus zero speed. I think you were emulating the ABS module right? In that case, the spinning out of control is actually probably your fault. If you had not emulated this, the system would realise there is an ABS fault (from the messages not being present) and not use the ABS reported speed. It might even fall back to motor speed automatically. Re: shaft scenario, if the motor shaft is broken the safety risk is pretty minimal because the torque wont actually cause the car to move. I guess this is what they arrived to in the FMEA.

aetherspawn 2y ago
Funnily enough I noticed recently that Japanese and Korean engineers usually argue against using checksums and random magic rolling bytes on these messages (“it will never happen”), in contrast Euro engineers use them everywhere. In this case the Euro method although more complex would have let the system know you are spoofing the ABS and no such motion would have happened.
- jeffreygoesto 2y ago
  Well. Reading out failure memory from ECUs couple of years old showed us that all chechsums failed several times over that time...
- Bluecobra 2y ago
  It makes we wonder if they have to do it that way, after what happened with VW lying about their diesel emissions.
- tanjtanjtanj 2y ago
  My European car (2013 Volvo) had no checksum or even identifier for the firmware as I found out when my car would just randomly cut all power at speed. I brought it back to the dealership and they found it had a completely different car’s update (2017 different model) installed!
Dylan16807 2y ago
> I think you were emulating the ABS module right? In that case, the spinning out of control is actually probably your fault. If you had not emulated this, the system would realise there is an ABS fault (from the messages not being present) and not use the ABS reported speed. It might even fall back to motor speed automatically. If the ABS unit getting stuck causes that kind of acceleration then I'm going to point most of the fault at the control logic.
- aetherspawn 2y ago
  Not really.. it will only be applying 5Nm or so which is such a small amount of torque that you could likely stop the wheel with your hand (equivalent to holding up 500g object with 1m ruler) He is spoofing an ABS message from a working vehicle that says “no faults present” on a vehicle that is clearly full of faults.

rightbyte 2y ago

Interesting. Sounds like really bad software. There should be some sort inertia estimation turning off the motor if the inertia don't include the wheels or whatever. There should also be some check that output axis speed (abs sensors) and motor speeds match. The behaviour sounds kinda dangerous and not up to ECU standards.

aetherspawn 2y ago
We don’t implement stuff like this because it would go off when you’re going down a slight incline for example, and the more bandaids you slap on it to get it to work, the more complex testing the failure scenario would be.